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PREFACE 


This year's Annual Report from the Aerospace Safety Advisory 
Panel has been divide.d into two parts. The first part, dated 
February 5, 1975, covered the Apollo Soyuz Test Project. This 
part, Part II, covers the Panel's efforts on the Space Shuttle 
program. 

The Panel has been conducting reviews of the many aspects of 
the Shuttle since September 1973 and considers this year's 
Shuttle report to be the second in a continuing series of 
reports. Reviews to date indicate that NASA is proceeding in 
a reasonable manner to develop a technical basis for confidence 
in crew safety. This judgement is based upon confidence in 
(1) the review system which evaluates the adequacy of mission 
requirements and whether the design approach meets them, (?) the 
suitability of the test program to qualify Shuttle hardware/soft- 
ware, (3) the assessment of hazards and their resolution, and 
(4) the development process for subsystems critical to crew 
safety . 
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1.0 INTRODUCTION 


1.1 Obiactlv 

The objective of the Panel's review of the Space Shuttle Program 
has been to evaluate whether the program Is proceeding through a 
reasonable process to develop a responsible level of crew safety. 
Confidence In crew safety Implies confidence in such areas as: 

(a) NASA at.d contractor management systems, including 
policies, practices and procedures for the development of critical 
systems, subsystems and integration of the program elements. 

(b) Technical development status of critical systems, 
subsystems and interfaces. 

(c) Test program to qualify Space Shuttle elements (Or- 
biter, External Tank, Main Engines, Solid Rocket Booster, Ground 
Support Facilities). 

(d) Identification and resolution of hazards. 

(e) Mission operations and contingency planning. 

1. 2 Panel Activities 

Since its last report the Panel has held detailed discussions 
with the contractors for the Orbiter, Space Shuttle Main Engines, 
and External Tank as well as with subcontractors for such critical 
subsystems as the Orbiter Thermal Protection Subsystems and the Main 


Engine Controller. We have had repeated discussions with the Shuttle 
Program and Element Project Managers at the NASA Centers. In addition, 
the Panel has physically examined the available Shuttle hardware, 
fabrication and assembly facilities and test areas. 

A summary of the agenda for these fact-finding activities is 
provided in Attachment 1. The Panel also had a great deal of support- 
ing documentation made available to them as required. 

In addition to the on-site activities mentioned above, the Panel 
has from tlme-to-tlme requested additional information to update or 
clarify specific individual interests. An example of this material 
Is presented in Attachment 2. 


2.0 OBSERVATIONS 

2. 1 Management 

In general the Panel found that the organizations and management 
systems implemented by NASA and its contractors for each of the 
Shuttle elements are adequate and appropriate for the current stage 
of the development program. Of particular note were significant 
changes in management of the Main Engine project and its critical 
Controller. These changes appear to have strengthened these management 
systems. 

Since the Shuttle is currently in the development phase, there 
are a number of technical management challenges to be met and resolved. 
Other.: will no doubt arise as the program evolves towards the 

operational phase. 
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An immediate need ie to strengthen the Shuttle integration 
function, particularly within NASA and to assure for the effective 
conduct of the "check and balance" role necessary to successful 
systems integration. Examples are the performance/cost/schedule 
tradeoff see" lea and the planning of element and integrated test 
programs. The current management system for Avionics hardware 
and software, particularly on the Orbiter vehicle, should be reviewed 
by senior program management to assure that capability is available 
to deal with the complexities of Shuttle avionics. The current in- 
tegration effort appears to be effective in the critical areas of defi- 
nition, documentation, and control of hardware interfaces whereas 
organization and management interfaces may require further attention. 

The numerous Shuttle Panels and Working Groups, established to 
bring all the available technical taier.t to bear on the day-to-day 
design and development problems, appears to be effective in support- 
ing NASA and contractor technical decisions and review requirements. 

The Panel feels a strong audit system is needed to check on day- 
to-day operations as well as a system for providing program management 
the opportunity to review risk assessment in a timely manner. Safety 
data must be made available early enough to be considered in the de- 
sign and test decisions. 

2.2. Shuttle Program Elements 
2.2.1 Orbiter 
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Although the Orbiter generally ia proceeding in a sat ia factory 
manner, certain critical areas have yet to be baaelined. Among these 
are the Thermal Protection Subsystem, Avionics System, and External 
Doors which must be reviewed in the very near future. 

Manufacturing procedures appear comparable to those observed 
on prior spacecraft production. The Panel has not visited subcon* 
tractors but there is a continuing need to monitor them. 

Obviously, there are many areas that we have reviewed and about 
which we could comment; however, we have decided to identify a few 
areas most critical to achieving a high order of crew safety. Changes 
in the design of the Thermal Protection Subsystem to use a "prepared" 
NOMEX felt on large areas of the Orbiter upper fuselage in lieu of thin 
tiles indicate a reduced hazard in this critical subsystem. In those 
areas where tiles and reinforced carbon-carbon are used, the challenge 
now appears to be installing and inspecting them before each mission 
rather than in the production of the tiles and nose caps. Installation 
and inspection problems as to tile-to-tlle steps and gaps are expected 
in meeting individual and multiple tile tolerance requirements. De- 
fining the inspection methods to assure tile internal integrity is 
currently under study. Test programs on the Thermal Protection Sub- 
system in high energy thermal and acoustic-vibration environments are 
continuing. 

Many door mechanisms are single failure points. The recent re- 
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due cion In the number of doors enhances the basis for confidence In 
crew safety. The Payload doors. Including radiators and operating 
mechanisms, still require further attention. In the light of the 
Skylab Re-let? Board's recommendations, doors should be treated as 
operating mechanisms rather than struct 're. 

Development of practical thermal seals in and around moveable 
aerodynamic surfaces and doors to prevent high heat loads on internal 
structure and oper ting hardware during entry present a design and 
test challenge. 

The dynamics of Orbiter separation from the External Tank are 
complex. A major concern is the design and fabrication of fittings 
and a command system that will operate in a precisely timed sequence. 
This will be necessary to avoid any vehicle Instabilities or debris 
impacting the Orbiter. 

The Panel suggests that management review once again the follow- 
ing areas to assure there is an adequate basis for confidence in 
crew safety: 

(a) The use of single actuators on the Orbiter elevons. 

(b) Decision to use free fall deployment of the nose and 
main landing gear immediately prior to runway touchdown. 

(c) The realism of those Reference Missions 1 and 3 re- 
quirements which affect safety because they are drivers on vehicle 
design. 
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2.2.2 Space Shuttle Main Engine* (SSME) 

The Integrated Subsystems Teat Bed engine moved through assembly 
ahead of schedule and the manufacturing personnel at Rocketdyne 
Division of the Rockwell International Corporation now have a better 
understanding of what will be required to produce these complex 
engines. The materials for the critical pcrts of combustion devices, 
turbomachinery and heat exchangers and c mplexlty of welds on engine 
assemblies present potential problems with hydrogen embrittlement. 

The test firing program will provide needed data on the ability to 
survive repeated firings at pressures and heat rates not previously 
experienced. 

Analysis indicated that the Space Shuttle may be subject to POGO 
(structural oscillations) not unlike those experienced by the Saturn V 
launch vehicles on the Apollo and Skylab programs. A POGO suppressor 
has been baselined and extensive tests coupled with analysis is cur- 
rently underway. This requires a closely integrated NASA-lndustry 
team effort. 

Experience during the past year with the Controller confirms 
that the technology of plated wire cores is at the state-of-the-art 
and there would be many problems to be resolved by a trial and error 
approach. 

Program Management's choice of an improved hydraulic fluid not 
only reduced the fire hazard but improved performance. There have 
been no major problems or additional costs associated with this change. 
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2.2.3 Solid Rockat Booster 


The solid rocket motor is basically within th current state-of- 
the-art of technology and design and fabrication of early units is 
underway. MSFC, as the Boost*. . Project Manager, indicates the de- 
sign and manufacturing of the motor case and propellant are up to 
expectations. The Panel's interest in the safety of a reuseable 
booster system is not because of a feeling that the system is inher- 
ently unsafe but because some of the Inherent penalties of a reusable 
system, i.e. greater weight and complexity, may well be drivers that 
affect . niter parts of the system and result in an overall more complex 
system with a somewhat lower spfoty factor. 

The Panel in its review has been impressed by the effort that 
has gone into implementing the reuseable concept. 

The areas requiring continuing management attention include: 

(a) Design of the remaining components of the SRB assembly, 
e.g., separation motors , avionics and parachutes. 

(b) Reliability of the gimbaling mechanism (thrust vector 

control) . 

(c) Reliability of the avionics subsystem. 

(d) Recovery, inspection and refurbishment procedures re- 
lated to their ability to provide confidence in the safe reuse of 

the booster. This includes the wisdom of reusing electrical circuitry 
and connectors in signal and control circuits that have been repeatedly 
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lmmarscd In salt water. 

(e) Parachute development and proo£ teatlng. 

(f) Hazard* to personnel Involved in the water recovery 
of the booster and parachutes. 

(g) Protection of the critical structural members against 
stress corrosion fractures. 

2.2.4 External Tank 

The External Tank Is the major element In the Space Shuttle 
system that Is expendable. The Panel's Interest focused on the dis- 
posal problems and on any hazards to the basic Orbltcr vehicle. 

The External Tank must be made to tumble after separation to 
assure a predictable reentry footprint. This requirement has gen- 
erated a set of ground rules for an acceptable disposal system and 
at the same time also requires: 

(a) Creation of a tank tumbling motion within a specified 
ten to fifty degrees per second. 

(b) Prevention of premature tank rupture. 

(c) Prevention of recontact with the Orbiter after separation. 
The disposal system selected will not only have to meet the technical 
ground rules but also the cost and weight constraints. 

Insulation material used on the external surface of the tank, 
as well as its configuration, is of significance in that outgassing 
and ablative products could adversely afiect the Orbiter' s Thermal 
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Protection Subsystem properties. Formation of ice/ frost on the tank 
and fittings could present a hazard to the Orbiter during launch. 

A potential hazard results from teflon Insulated wire routed 
through the liquid oxygen tank to various tank sansors. A special 
set of tests and analyses are being run under so-called "worst case 
conditions" to determine the risk involved. The Panel has requested 
that other methods of materials be Investigated to see what other 
possibilities are available regardless of the outcome of the above 
mentioned test and analysis program. 

2.2.5 Ground Facilities 

The launch and landing aspects of the Shuttle Program were 
recently reviewed by the Panel at KSC, and are an extension of the 
operations' ieviews conducted earlier. KSC's role on the Apollo and 
Skylab programs has provided excellent insight into the requirements 
for Shuttle facilities and ground support equipment. Trade-offs 
between costs and safety for ground Bupport equipment require con- 
tinuing management attention. The Panel will also continue to 
monitor these trade-offs. 

2.2.6 Test Program 

The Panel's questions fall mainly in the area of the proposed 
flight test program, i.e., the Approach and Landing Test and the 
first six developmental orbital flights. The Approach and Landing 
Test program may include as many as eleven low altitude flights 
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launched from Che Boeing 747 carrier aircraft modified for this pur- 
pose. During such flights there are separation effects to consider 
that may affect crew safety. Shuttle elements will be tested to- 
gether for the first time during the first vertical flight and as 
a result additional hazards may be revealed. Therefore, as the flight 
test planning evolves, management will need to give priority atten- 
tion to: 

(a) The risk versus the data obtained in the Approach 
and Landing Test. 

(b) Role of the crew in the control loop during the landing 

phase . 

(c) Analyses, procedures and training for contingencies 
including abort, ditching and landing accidents, including the impact 
on design requirements. 

(d) Proper role for range safety. 

(e) Development of an integrated hazard analysis of the 
first flight 'hat would give management a comprehensive profile of 
the risks and the alternatives. 

The Ground Test Program as presented to the Panel appears to 
meet the qualification/vaiidation requirements of the individual 
elements and the total integrated system. Continued study of the 
ground test program and its relationship to the flight test program 
is necessary to assure an orderly and timely approach to total 
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system verification. 
2.2.7 Range Safety 


The Panel has not reviewed the impact of the range destruct 
system but feels that its interface with the Booster or Orblter 
systems isuat be spelled out because it can well become a part of 
the software as well as the hardware system. Such questions as 
when and how does it override the computer and manual control is 
an Important factor in planning and design. 
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3.0 CONCLUSIONS AND RECOMMENDATIONS 


3.1 Generally , the management ayatem la adequate for the current 
state of development. 

3.1.1 Systema integration management needs to strengthen its 
"check and balance" capability. 

3.1.2 The management system for avionic hardware and software 
should be reviewed by senior program management to assure it is 
adequate for the indicated complexity of the program. 

3.1.3 It is Important that senior program management review both 
the scope and results of safety analyses to reinforce early reso- 
lution of risks. Similarly, attention should also be given to the 
scope and results of technical management audits to assure that 
such systems as described to the Panel are being applied properly. 
Two examples are Configuration Management and Material Control. 

3.2 The development of the Orbiter system is proceeding as 
scheduled. Manufacturing procedures appear comparable to those 
used on prior spacecraft programs. 

3.2.1 The design and quality control for the doors, Thermal 
Protection System penetrations and thermal seals should be closely 
monitored by management to assure that the reliability necessary 
to satisfy safety will be achieved. 

3.2.2 The procedures, instructions and training requirements for 
installation and quality control of the Thermal Protection System 
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component* should be reviewed by program management to assure the 
aero /thermodynamic requirements are met. 

3.2.3 Free fall deployment of landing gear may introduce safety 
problems. Therefore the use of a positive system for rapid 
extension of land-* ; gear should be considered. 

3.3 The major challenges of significance for crew safety on the 
Space Shuttle Main Engine are materials behavior under severe 
environments, weld integrity, POGO suppresion and engine Controller 
performance and reliability. Therefore the 'results of the test 
program will be critical to developing confidence in these areas. 

3.4 The major challenges on the External Tank of safety significance 
are thermal insulation, ice formation, the use of teflon electrical 
wire insulation in the liquid oxygen tank and provisions for control 
of reentry. 

3.5 The Solid Rocket Booster is in an early stage of development. 
Critical areas must be monitored closely for the earliest possible 
detection and resolution of problems to assure that trade-offs pro- 
vide for the maximum Shuttle system safety. Such areas include 
recovery and re-use of the booster. 

3.6 The program in assuring the cost effectiveness of its re- 
quirements for ground support equipment needs to assure safety 
receives appropriate attention. 

3.7 The program is in the period of defining the detailed 
requirements and plans for major development and flight testing. 


13 


Plans for ground testing appear adequate. Safety-related testing 
should be monitored to Insure It Is carried through as planned. 

The Interactions between the Orblter, External Tank and Solid 
Rocket Booster, Including separation dynamics are complex. Analyses 
based on ground testing should be thorough enough to maximize 
confidence In safe development flights. 

3.7.1 More Information is needed on the risks of Approach and 
Landing Testing in comparison with the value of information which 
would be obtained in such flights. 

3.7.2 The role of man-in-tho-loop, especially d>. ring landing, 
rollout and braking, needs re-examlnatio.t as the program reaches 

the point where avionics' capability and limitations are better known. 
3 7.3 Contingency analyses especially for aborts, ditching, landing 
accidents, and range safety should be completed early enough to assure 
design solution rather than operational work-arounds. 
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Challenges, Systems Safety 
Systems Tests 


ATTACHMENT 2 


MSFC RESPONSE TO ACTION ITEMS FROM THE PANEL'S 
INSPECTION TRIP OF APRIL 7-8. 
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REPLY TO 
ATTN OF 


SAO 1 


NATIONAL AERONAUTICS AND SPACE ADMINISTRATION 
GEORGE C. MARSHALL SPACE FLIGHT CENTER 
Marshall Space Flight Center. Alabama 35812 


jut . : ' 


TO: NASA Headquarters 

Attn: APA/Mr. Howard Nason 

FROM: SAO 1 /Robert E. Lindstrom 


SUBJECT: Action Items /Aerospace Safety Advisory 

Panel Visit, April 7 and 8, 1975 


4 0^ t, o* 





As discussed during the April 8 wrap-up session and in accordance 
with your correspondence of May 23, 1975, this memorandum is 
being forwarded to close certain actions as well as provide projected 
response dates on the remaining actions recorded during the subject 
visit. We are also addressing several additional actions provided 
to us by Dr. Mrazek in early May and documented by your May 23 
correspondence. 

We have provided briefings to Dr. Mrazek on the below items and 
believe these actions to be closed: 

• jrnal Tank anti -geysering test program. 

• MSFC sonic boom activities in support of JSC and RI 
integration efforts. 

• Acoustic, vibration, and thermal load data included on 
element Interface Control Documents. 

• Economics supporting recovery and reuse of Solid Rocket 
Booster. 

• Solid Rocket Motor bi -propellant activities. 
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We will follow-up on the briefing provided to Dr. Mrazek on SRB 
Recovery Syatem with a written reeponee to the Panel by June 16 
on: 


• Possibility of premature actuation of the SRB Recovery 
System and the effects of such an actuation. 

e Quality control efforts planned for the SRB Recovery System 
based on prior Air Force drone recovery system experience. 

Enclosures 1 through 10 address our responses to action items on: 

e FMEA Critical Items List 

a Secondary Structural Items 

• Hazard Analysis Status 
e 707 5 -T 6 Material 

e Teflon Insulated Wire 

• Material Management System 

• ET Lightning Protection 

• Freezing/Breakoff of Condensation -- Damage to Orbiter TPS 

• SSME Heat Exchanger Leakage Limits 

• SSME Lightning Protection 

e Utilization of Teflon Balls in POGO Suppressor Unit 

As you can note from our responses, several of these actions are 
still in the analysis and coordination phase with JSC. Further data 
will be supplied to the Panel upon completion of this phase. Also 
at this time, we are still in the process of addressing the differences 
between MSFC's and JSC's production hardware component acceptance 
test vibration requirements. We should be in a position to provide 
this response to the Panel on June 16. 
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While Mr* Praktiah was here for the ASTP pre-FRR, we discussed 
with him the deferment of the below items to more appropriate groups 
for addressing the Panel's concerns: 

• SSME Critical Failure Periods during the Ascent/Actions 
to alleviate resulting problems (JSC/RI), 

• Safety problems associated with SRB retrieval at sea (KSC). 

As we discussed during your visit to MSFC, the question of critical 
SSME failure periods relate to vehicle control problems. While 
we are participating ve^y closely with JSC in this area from vehicle 
structural limits, etc. , the critical time periods are mission/wind 
dependent and this area should be addressed by JSC. Also, KSC 
is carrying out the planning and development activities associated 
with the SRB retrieval activity. 

As we discussed with Mr. Praktish, we will stand ready to respond 
to any questions that might arise on the attached responses and w'll 
work toward having all of the actions closed by June 16. We appre- 
ciated the opportunity to review our project elements status and 
activities with you and the Panel and will look forward to further 
discussions with you and the Panel members as we progress through 
the Shuttle program. 

. v ^ ^ 

Robert E. Lindstrom 

anager, Shuttle Projects Office 

10 Enclosures 
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Aerospace Safety Advisory Panel 
FMEA/Critical Items List 


Attached are copies of the Failure Mode Effects Analysis (FMEA/ 
Critical Items Lists (CIL) for the Space Shuttle Main Engine, External 
Tank, and Solid Rocket Booster* (Copies available in Panel office. | It 
should be noted that the FMEA /CIL enclosures are preliminary issues 
originally released at the Preliminary Design Review, except for the 
SSME which was updated November 1974, and as such, they have not 
yet been accepted by MSFC as a baseline list of critical hardware. 

The lists arc being continuously updated as the design becomes more 
mature, and it is expected that they will be reduced significantly in 
the future. Also, MSFC has an effort in progress to evaluate these 
FMEA/CILs, and to assure that all critical failure modes are identified 
and minimized by elimination through design approaches or by redundancy. 
Fina 1 acceptance of the list will occur in conjunction with the baselining 
of the design at Critical Design Review. 

S econdary Structural Items 

Relative to the requirements that we a~e utilizing to assure that 
proper FMEA review is given to secondary structural items to account 
for items similar to the Skylab meteoroid shield, a number of actions 
should be recognized. As you are awa**e, special attention is given 

Enclosure 1 
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to structure* a* well aa other paaaive componenta auch aa wiring and 
tubing during the initial deaign and teat phase*. Thia attention conaista 
of a atreaa analyaia which ia analogous to a ainglc failure mode effects 
analysis to assure that the paaaive componenta will withstand all 
predicted stresses with a reasonable safety margin. For passive eompon. 
which a/e of a new design, the stress analysis is not considered adequate 
and environmental tests are initiated to verify the strength and reliability 
of such members. Of special interest are passive components in high 
pressure aystems and the rupture failure mode for pressure vessels 
and flex hoses are considered in the failure mode effects analysis. 

Action has also been initiated to require FMEA evaluation of hardware 
items whose structural failure due to aerodynamic stresses could have 
a critical effect; e. g. , fins /tarings, shields, external insulation, 
external conduit and piping, exposed deployable/separable hardware, and 
access panels /doors. Those hardware items will then be reviewed 
to assure that all aspects associated with their design and test program 
are given proper attention (structural/aerodynamic analysis, testing, 
material selection, bonding, attachment methods, sealing, and inspection 
techniques). 
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Aerospace Safety Advisory Panel 


Hazard Analysis Status 

As was noted in the response on the status of Failure Mode Effects 
Analysis (FMEA)/Critlcal Items Lists (CIL) activities on our projects, 
we are presently reviewing and analyzing the FMEAs / CILs released 
at the Preliminary Design Reviews on each of the MSFC Shuttle Projects. 
Our hazard analysis activity is proceeding in parallel with FMEA/CIL 
activity. Additionally, each of our elements arc making Inputs into the 
Element Interface Functional Analysis (EIFA) being developed by JSC 
for: 

Space Shuttle Main Engine /Orbiter 

Solid Rocket Booster /External Tank-Orbiter 

All of these activities are focused on providing early visability of hazards 

to provide for minimizing hazards either through design approaches or 

redundancy prior to the element Critical Design Reviews. At this time, 

we are still in the process of establishing the milestones for completion 

of our analysis of the FMEA/CIL and the hazards list developed thus 

far by our clement contractors. However, these documents arc the 

subject of on-going technical and management reviews at Level III and 

Level II toward assuring that all failure modes, etc. , arc being covered. 

Enclosure 2 
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Aerospace Safety Advisory Panel 


7075-T6 


Action Item: Provide Panel with relatiop lip between the rejection of 
7075-T6 material in the lunar module to the initially planned use of 
this material on the ET intertank. 


7075-Tf) forgings and plate were rejected for use on the lunar module 
because of susceptibility to strcBB corrosion cracking (SCO. The 
threshold tensile stress for onset of SCC is approximately 7000 psi 
for 7075-T6 stressed in the short transverse direction. This stress 
level can easily be exceeded in forgings and in plate material. It is 
nearly impossible to exceed the threshold stress in the short transverse 
direction in sheet material, hence the use of 7075-T6 sheet material 
is acceptable, provided it can be shown that the intended use meets 
the requirement of no short transverse tensile stresses exceeding 
7000 psi. 

The concern with the planned use of 7075-T6 by MMC had to do with 
notch sensitivity, and not SCC, The MMC usage involved 7075-T6 
sheet largely, which will be exposed to linuid hydrogen temperatures. 

At LH 2 temperature the notch strength of 7075-T6 is inferior to both 
2024-T7 and 7075-T73 hence the use of 7075-T6 sheet has been limited 
to temperatures no colder than -200°F. Any remaining 7075-T6 sheet 
uses at > - 200°F have been certified to have negligible short transverse 
tensile loading. 


Enclosure 3 
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Aerospace Safety Advisory Panel 
Teflon Wire Usage in LOX/GOX Environment 


The ET Pio.iec.t selection of Teflon (FEP) insulated wire was based 
on extensive Saturn experience and testing in identical environments. 
These environments differed drastically from the high pressure two 
phase system ur.td on Apollo. 

Our test e xperience on the Saturn Program with this wire insulation 
may be summarized as follows: 

a. No ignitiions could be induced in LOX environments in any 
case tested. 

b. Ignitions could be induced in GOX (55-75 psi) environments 
only with 1500% electrical overloads. In crises where ignition was 
initiated, the wire and insulation self -extinguished at the wall of 
the test chamber and drip burn products wi re quenched by the LOX 
in the test chamber. 

c. Using flight hardware connectors, connector pins failed before 
the wire could be overloaded to a point where ignition could occur. 

The current ET design uses 22 gage Teflon (PEP) insulated wire 
for the liquid level and loading sensors in the LOX tanks. This 
wire capability is: 

a. Fusion current - 60 amps 

b. Recommended design capability - 15 amps 

c. Normal ET usage - 0. 09 amps 

d. Maximum ET current (limited by sensor fusing) - 1. 5 amps 

Therefore, it is MSFC's conclusion that the flammability testing 
experience during the Saturn Program and specific tests required 
by NIIB 8060. 1A will verify the acceptability of the current design. 
The most critical test of this specification is electrical overload 
on actual harnesses at worst case temperatures and pressures. 
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This test will be performed when actual production harnesses arc 
available, which will not occur for some time. 

MSFC recommends that this action be cloyed based on our com- 
pliance with NIJB 8060. 1A. Should the harness overload teat fail, 
then corrective action will be implemented. 
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Material Management System 

The question as posed in the May 23 correspondence asked for the 
specific management system being utilized that assures that stress 
corrosion problems are under control. Our briefing to the Panel on 
April 7 addressed our utilization of a materials specification and the 
requirement for submission of Materials Usage Agreements to a 
Materials Applications and Evaluation Board (MAEB) when a deviation 
from the specification was being considered for implementation. The 
MAEB is chaired by the Director, Materials & Processes Laboratory. 

Regarding the visability that is conveyed across the program 
elements on any approved deviations from the materials specification 
information is being provided through two methods at the present times 
The requirement for MATCO Forms (Material Tracking and Control) 
is being implemented on Shuttle Projects for transmittal to JSC/RI/SD 
and daily exchanges of information are taking place between materials 
and processes personnel throughout the NASA organizations. Additionally, 
JSC will be placed on the distribution for the Material Usage Agreements 
processed on MSFC Shuttle Projects. Visability across the program 
elements and NASA Centers is further enhanced by the release of 
SAF-ALERTS and ALERTS on material or material process problems 
experienced during the development, testing, and production of hardware. 
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Lightning - External Tank 


Action: 


Provide closeout documentation on the ET lightning protection imple- 
mentation. 

Discussion: 


a. Two meetings of Iho Lightning Team were held on April 2.1, 1975, 
and May 20, 1975, to assess ET progress. 

b. The assessment is now being directed to defining swept stroke 
lightning model which, is representative of the conditions ET can expect 
during ascent. This approach is based on: 

(1) ET will be protected on the launch pad by the KSC Facility 
Protection System, 

(2) 'Die Shuttle Vehicle v. ill not be Lim'-hcd tnrorgh a thunder- 
storm, rain, or haiJ because of structural or Orbiter TPS conditions. 

(3) ET involvement with lightning because of these constraints 
will be ai some minimum altitude and vehicle velocity. 

(4) Vehicle velocity at the minimum altitude is a factor in 
assessing the lank burn through potential which is the prime concern 
in ET lightning protection. 

c. JSC and consultants will develop swept stroke lightning model 
on or about June 18 , 1975 . Another team meeting will be established 
thereafter to discuss verification aspects. 

For contingency purposes, MMC will c.ont nue the investigation 
of suitable metallic paints for diverter strips and will perform tests 
to determine burn through limits of the ET tank walls. 

Conclusion: 


ET lightning protection design is currently predicated upon use of the 
GO^ pressurization line and a lightning rod for swept stroke lightning 
dispersion. It is anticipated that the current design will meet the 
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intent of the Level II lightning specification when that specification is 
corrected to recognize swept stroke design criteria. Verification 
of design performance will be accomplished through analyses and 
einpcrical data. 
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Potential Ice Damage to Orbiter TPS 


MSFC does not have a test program to specifically define /establish the 
effect of condensation forming on flight type interface structure and 
subsequently running down the tank and freezing, which may result in 
damage to the Orbi^et TPS, However, as a part to the ice /frost tost, 
using a 10 -fool tank at EAFB, water, fog, and mist will be applied to 
the tank sidewall including simulated interface structure under antici- 
pated worst environmental conditions. Results of this testing (quantitative 
ice /frost characteristics) will be provided to the System Integration 
Contractor for defining the Orbiter TPS tolerances for ice /frost debris. 
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Allowable SSME Heat Exchanger Oxidizer Coil Leakage Rate 

During the presentation on this subject the Safety Panel questioned t \e 
allowable heat exchanger oxidizer coil leakage rate of 1 X 10“^cc helium/ 
second. It was stated that the present technology in leak detection permits 
measurement of leakage at considerably lower rates. The Panel position 
was correctly stated since leakage rates in the range of 1 X 10'^cc 

■j 

helium/second are detectable with mass spectrometers and halogen leak j 

detectors. However, the SSME allowable heat exchanger coil leakage 
was not established based on measurement capabilities in a controlled 
laboratory but rather the feasibility of measurement in a field operational 
environment with a specified turnaround time. The minimum expected 
leakage with welded joints was also considered. Our present plan is to 
allow leakage of 1 X 10"^cc hel ium / second during component tests 
and 1 X 10'^cc helium / second during the field operational leak test 
inspection. The adequacy of this approach will be verified during the 
engine development (DVS) test program and the allowable heat exchanger 
leakage will be reassessed against our latest test results. 
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LIGHTNING - SPACE SHUTTLE MAIN ENGINE 


Action : 

Provide closeout documentation on the SSME lightning protection. 
Discussion : 

a. Rocket. dyne assessment of JSC 07636(Space Shuttle Lightning 
Protection Criceria Document, dated September 11, 1973) was completed 
and provided to MSFC oa April 23, 1975. 

b. MSFC is in process of evaluating the Rocketdyne assessment to 
determine the degree of change, if any, that MSFC will recommend be made 
to the SSME design. The MSFC assessment is based on the following: 

(1) On-Pad Protection : The SSME, as well as the entire Space 

Shuttle Vehicle, will be protected on the launch pad by the KSC Facility 
Protection System. 

(2) Ascent Protection - Direct Strike : The SSME is in cones 

of protection of the Orbiter stabilizer and SRB's on ascent; hence, a 
direct strike (200 KA current) to the SSME on ascent and the resulting 
direct effects (blast, burn, etc.) are ruled out. Tests by MDAC for 
JSC have confirmed this SSME protective situation. (Reference McDonnell 
Douglas Corporation Report MDCA3155, "Final Report, Simulated Lightning 
Test, Shuttle 0.03 Scale Model", October 25, 1974). In addition, the 
heat shield is expected to divert the direct stroke around engine com- 
partment. Thus, only the nozzle could be liable to direct effects 
damage . 


(3) Reentry Protection - Direct Strike : A direct strike to 

the SSME on reentry (200 KA current) may be possible, but similar MDAC 
tests are necessary to determine If the SSME may also be in a cone of 
protection, ruling out this situation. Such a strike, however, would 
not affect the mission since the SSME is inoperative on reentry. Only 
minor damage, if any, would be sustained by the SSME to the nozzle since 
the heat shield would divert the current from the nozzle around the engine 
compartment . 

(4) Protection - Indirect Effect : Indirect effects (induced 

voltages and currents caused by electromagnetic fields) are based upon 
field strengths provided by JSC. A change to add shielding to most SSME 
electrical harnesses will provide complete SSME protection from indirect 
effects based upon JSC provided data. Engine shutdown due to indirect 
effects would thus be prevented on ascent. 
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(5) Current SSME Capability : Current SSME design Is adequate 

if launch restrictions due to weather are imposed, and if the defined 
maximum strike current and induced field levels are too conservative. 

(6) Swept Stroke : The SSME is subject to swept stroke lightning 

on ascent and reentry, but tests by Lightning Transients Research Corp. 
(LTRI Report No. 563) indicate no damage to nozzle if 100 KA current stroke 
is swept along by 90 mph air flow. JSC and consultants plan to develop 
swept stroke lightning model in June on which further assessment can be 
made . 


(7) The SSME is protected by a shroud during ferry flights. 

c. MSEC recommendation will be made to JSC (Shuttle Program Manager) 
by June 20, 1975, upon completion of the MSFC evaluation. 

Cone 1 us ion : 

Current SSME design appears to afford adequate protection if appropriate 
launch and reentry constraints are imposed. Added shielding to harnesses 
($1M) will protect from engine shutdown on ascent provided a direct strike 
to SSME is ruled out as a possibility. Full implementation of protection 
against direct strike during ascent is not considered warranted based on 
test data. 
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Utilization of Teflon Balls in POGO Suppressor Unit 

The analyses supporting the subject utilization (acting as a membrane 
on the liquid surface) were covered with Dr. Mrazek in a separate briefing. 
The initial POGO suppressor design effort did consider a flexible membrane 
in lieu of Teflon balls. The Rl/SD concept, located upstream of the low 
pressure oxidizer pump, used a flexible membrane, Rocketdyne's 
suppressor is located downstream of the pump and is exposed to higher 
pressure differentials. A flexible membrane was considered but the 
pressures and increased compliance to the system led to utilization of 
the Teflon balls. 

Concern for the difficulty in developing the hollow Teflon balls was 
discussed and the possibility that the balls may have to be stainless 
steel with Teflon coatings was covered. The emphasis will remain on 
the use of Teflon due to its recognized LOX/GOX compatibility properties. 
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